Re: [Cfrg] Side channel attack and Edwards curves...

[Phillip Hallam-Baker <[e-mail]>]

On Wed, Jul 5, 2017 at 5:03 PM, Taylor R Campbell <[e-mail]>
wrote:

> > Date: Wed, 5 Jul 2017 14:38:18 -0400
> > From: Phillip Hallam-Baker <[e-mail]>
> >
> > http://thehackernews.com/2017/07/gnupg-libgcrypt-rsa-encryption.html?m=1
> >
> > Just another side channel attack and not something that bothers me
> writing
> > reference code. But have we maybe put our eggs in the Montgomery ladder
> > basket when maybe we should have gone for 'randomly split the private key
> > into two parts, perform two separate multiplications with each part and
> add
> > the result'.
> >
> > We can play the blinding game in Edwards or Montgomery but it is easier
> in
> > Edwards.
>
> You can always convert from Montgomery x to Edwards (x, y) and back
> without losing anything and costing only one field element inversion;
> see XEdDSA <https://whispersystems.org/docs/specifications/xeddsa/>
> for something similar.
>
> But there is no reason to flail around with blinding when you can just
> use constant-time code for both Edwards and Montgomery arithmetic.
>

'​Just use ​finely ground unicorn powder'.

I don't think the constant time code survives modern optimizers or hardware
accelerations nearly as robustly as you imagine. I would much rather go
with an approach that does not depend on the vagaries of implementation.

​The main reason not to do this was the Kocher patents on blinding. But
those are expiring soon.​